{"id":"CVE-2026-109216","aliases":["EUVD-2026-112746","GHSA-74q7-5hgm-hhc8"],"status":"published","title":"Meta Box \u003c= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys","description":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[\u003cattacker-chosen key\u003e]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00228,"percentile":0.1371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-29T11:27:14Z","modified":"2026-10-31T02:47:30Z","products":[{"vendor":"metabox","product":"meta box – a framework for dynamic websites"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8948f5-8bcf-48f2-b3a6-bfa24ba9bef0?source=cve","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.2/inc/fields/background.php#L154","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.2/inc/sanitizer.php#L170","tags":["web"]},{"url":"https://github.com/wpmetabox/meta-box/pull/1709","tags":["fix"]},{"url":"https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.3/inc/fields/background.php","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109216","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-74q7-5hgm-hhc8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109216.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-109216","title":"Meta Box \u003c= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys","description":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[\u003cattacker-chosen key\u003e]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.","status":"published","published":"2026-10-29T11:27:14.853Z","modified":"2026-10-29T12:36:51.108Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:11.24076Z"}],"euvd":[{"id":"EUVD-2026-112746","description":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[\u003cattacker-chosen key\u003e]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.","status":"published","published":"2026-10-29T11:27:14Z","modified":"2026-10-29T12:36:51Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:16.844933Z"}],"ghsa":[{"id":"GHSA-74q7-5hgm-hhc8","title":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored...","description":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[\u003cattacker-chosen key\u003e]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.","status":"published","published":"2026-10-29T12:30:37Z","modified":"2026-10-29T12:30:46Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:38.164928Z"}],"nvd":[{"id":"CVE-2026-109216","description":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[\u003cattacker-chosen key\u003e]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.","status":"published","published":"2026-10-29T12:17:09.64Z","modified":"2026-10-29T14:56:26.107Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:04.6346Z"}],"osv":[{"id":"CVE-2026-109216","title":"Meta Box \u003c= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys","description":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[\u003cattacker-chosen key\u003e]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.","status":"published","published":"2026-10-29T11:27:14.853Z","modified":"2026-10-31T02:47:30.290341602Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:55.279797Z"}]}}